WEBSITE MAINTENANCE STATEMENT OF WORK ===================================== Disclaimer — not legal advice. This template is provided free of charge, as is and with no warranty of any kind, and using it creates no attorney-client relationship. It is jurisdiction-neutral: you are responsible for adapting it, for your own legal and tax compliance, and for having a qualified professional in your jurisdiction review it before you rely on it. Full terms: https://trycolo.co/terms-of-use SOW reference: [SOW-NUMBER] | Date: [DATE] Provider: [YOUR BUSINESS NAME] ("Provider") | Client: [CLIENT LEGAL NAME] ("Client") Governing agreement: [RETAINER AGREEMENT / SERVICE CONTRACT AND DATE] Client contact for incidents: [NAME], [PHONE], [EMAIL] | Backup contact: [NAME], [PHONE] 1. Plan summary --------------- Field | Detail ------------------------- | ---------------------------------------------------------------------------- Site(s) covered | [DOMAIN 1], [DOMAIN 2] Platform | [WordPress / Webflow / Shopify / custom: STACK] Hosting provider | [PROVIDER AND PLAN] Plan tier | [ESSENTIAL / STANDARD / PRIORITY] Monthly fee | [CURRENCY] [AMOUNT], invoiced [in advance on the 1st] Monthly hours bank | [N] hours for section 5 work Support hours | [DAYS], [TIME] to [TIME] [TIMEZONE], excluding [PUBLIC HOLIDAYS IN LOCATION] Start date / minimum term | [DATE] / [N] months 2. Covered tasks and schedule ----------------------------- Task | Frequency | Notes --------------------------------------- | --------------------------------------------- | ----------------------------------------- Core / platform updates | [Monthly / within N days of security release] | Tested on staging first [ ] Yes [ ] No Theme and plugin / app updates | [Weekly / monthly] | Rollback if an update causes errors Uptime monitoring | Every [5] minutes | Alerts to Provider; see section 4 Security scan | [Weekly] | Malware and known-vulnerability checks Backups | See section 3 | Broken link and form check | [Monthly] | Contact and checkout forms test-submitted Performance check | [Monthly] | Home page and [N] key pages SSL certificate and domain expiry check | [Monthly] | Client renews domain unless stated Spam and comment moderation | [ ] Included [ ] Not included | Monthly care report | Monthly | See section 8 3. Backups and restore ---------------------- 3.1 Schedule: [daily] full backups of files and database; [hourly / none] database backups for e-commerce sites. 3.2 Storage: backups are kept off the hosting server at [STORAGE LOCATION] for [30] days. 3.3 Restore test: a restore to a staging copy every [quarter], with the result in the care report. 3.4 Restore on request: restoring the live site from backup is [ ] included [ ] billed from the hours bank. 4. Incident severity and response times --------------------------------------- Response time is the time from the Provider receiving the alert or report to acknowledging it and starting work. Resolution time depends on the cause and is not guaranteed. Severity | Definition | Response time (support hours) | Response time (outside support hours) | Progress updates -------- | --------------------------------------------------------- | ----------------------------- | ------------------------------------- | ---------------- Critical | Site down, checkout or payments broken, site compromised | [RESPONSE TIME, e.g. N hours] | [RESPONSE TIME or "next support day"] | Every [N] hours High | Key function broken (forms, login, search), no workaround | [RESPONSE TIME] | Next support day | Daily Medium | Feature or page broken, workaround exists | [RESPONSE TIME] | Next support day | On resolution Low | Cosmetic issues, typos, minor layout | [RESPONSE TIME] | Next support day | On resolution 4.1 Incidents are reported by [PHONE / EMAIL / WORKSPACE]. Critical incidents should be reported by [PHONE / CHANNEL]. 4.2 The Provider sets the severity using the definitions above and will discuss it with the Client if they disagree. 4.3 Incidents caused by the host, a third-party service or changes made by the Client or others are investigated, and fixing them is [ ] included [ ] billed from the hours bank or at the overage rate. 5. Monthly hours bank --------------------- 5.1 [N] hours per month for small changes: content edits, image swaps, new pages from existing templates, minor layout adjustments, plugin configuration. 5.2 Time is logged in [15]-minute increments. 5.3 Rollover: [ ] None [ ] up to [N] hours into the next month only. 5.4 Overage: [CURRENCY] [RATE] per hour, only after written approval. The Provider notifies the Client at [80]% of the bank. 5.5 Any single request estimated above [N] hours is quoted as a separate project. 6. Exclusions ------------- Not included in the monthly fee: - New features, new page templates, redesigns or rebuilds - Content writing, photography and design of new assets - Clean-up of a compromised site beyond [N] hours - Migration to a new host or platform - Fixes required by changes made by the Client or third parties without the Provider's involvement - Third-party costs: hosting, domains, premium plugin or app licenses, email services 7. Accounts and access ---------------------- Account | Owner | Provider access ----------------------------- | ------------------- | ----------------------------- Hosting | [CLIENT] | [ADMIN / SFTP / SSH] Domain and DNS | [CLIENT] | [DNS EDIT / NONE] CMS / platform admin | [CLIENT] | Admin user in Provider's name Premium plugin / app licenses | [CLIENT] | [LICENSE KEYS SHARED] Backup storage | [CLIENT / PROVIDER] | [ACCESS] 8. Monthly care report ---------------------- Sent by the [5th] business day of each month: updates applied, backup status and last restore test, uptime incidents and response times, security scan results, hours bank used and remaining, recommendations. 9. Fees, term and ending ------------------------ 9.1 Monthly fee invoiced on the [1st], due within [N] days. Overage and pre-approved third-party costs are added to the next invoice. 9.2 After the minimum term, the plan continues month to month with [30] days' written notice from either party. 9.3 On ending, the Provider delivers a final backup, removes its own access, transfers any accounts held for the Client and documents plugin licenses and credentials handed over. 10. Acceptance -------------- Provider | Client ------------------------------- | ------------------------------- Signature: ____________________ | Signature: ____________________ Name: [NAME] | Name: [NAME], [TITLE] Date: [DATE] | Date: [DATE] ------------------------------------------------------------ How to use this template 1. Fill section 4 with response times you can staff on your worst week, not your best. 2. Run an onboarding audit before signing if you did not build the site, and list known issues as exclusions. 3. Confirm backups are stored off the hosting server before the first month starts. 4. Review the tier every six months against the hours actually used. Template provided by Colo (trycolo.co). Not legal advice — review with a qualified professional in your jurisdiction.